The vulnerability in Oracle Contract Lifecycle Management for Public Sector allows an attacker with low privileges to exploit the system over HTTP and gain unauthorized creation, deletion, or modification rights to critical data. As a result, confidential and integral information can be altered or accessed in full, degrading the system’s data integrity and confidentiality.

Oracle Corporation’s Contract Lifecycle Management for Public Sector, specifically the Award/PO component. Versions 12.2.3 through 12.2.15 are affected.

The CVSS 3.1 base score of 8.1 reflects high confidentiality and integrity impacts with a local privilege level requirement. The attack vector is likely network‑based via HTTP, as the description states an attacker must have network access. Exploitation is considered easily achievable given the low privilege requirement, but the EPSS score is unavailable, so the exact exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation reports at the time of assessment.